This’s a self made tools testing page of syslog-ng documentation

Description\subtitle is now not different than the normal, documentation body markdown texts.
Short title is used in the navigation bar.
It can contain ‘, and other special characters ()[].*?+^$, etc., though some of them might require escaping, e.g. \ or |
Mentioning documentation sections (markdown ##, or HTML <h 1-6> headings) via the exact section title text should work normally, like Slack destination options, but the linking can be forced as well via our custom markdown [[Timezones and daylight saving]] format.
Linking also could work with our markdown_link liquid include.
One more destination id=adm-about-glossary#bom override test from subtitle.
Macros test ${HOST}.
Liquid test syslog-ng documentation - syslog-ng documentation.
Markdown formatting should work as well, for example, bold and inline code tests.

H2 test row

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

H3 test row

H4 test row

H5 test row

H6 test row

Notice blocks and inline custom markdown

Verifies that {: .notice--primary|info|warning|danger|success } block attributes are honored, that \{: ... \} literally escaped attribute markers stay visible, that bold/macro/Liquid expansion still works inside notices, and that the custom [[parser: ...]] autolink form (title containing :) resolves.

For the conventions and the CSS-driven icon and label auto-injection rules, see Notice blocks.

The block below must render with one caution icon and one bold WARNING: prefix supplied by CSS — the source contains neither.

The auto-injected prefix flows inline with the first line of the body text.

This is a {: .notice–info} test
any modifications or changes, use the flags(no-parse) option in the source definition, and a template containing only the ${MESSAGE} macro in the destination definition.

To parse non-syslog messages, for example, JSON, CSV, or other messages, you can use the built-in parsers of syslog-ng OSE. For details, see parser: Parse and segment structured messages.

multi line backticked text should be visible in a single line

Markdown link tests:

1st a source title - [a source title](url1){: }

2nd a source title - [a source title](url2)

3rd a correct reference link declaration - [a source url_ref]: url3 - (hopefully totally invisible)

4rd a reference link declaration with a missing space after : - [b source url_ref]:url4 - (hopefully totally invisible)

5th a source title using reference link 1 - [a source title][a source url_ref]

6th a source title using reference link 1 with more than 1 space between the [][] parts - [a source title] [a source url_ref]

7th b source title using reference link 2 - [b source title][b source url_ref]

8th [source title]{ b source url_ref } - non-reference { ... } form after [text] (curly, not square brackets) - neither part is a kramdown link, both render as literal text - [source title]{ b source url_ref }

9th [a source]{: class=”” } - kramdown IAL with empty class on a non-link [text], single known token inside - [a source]{: class="" }

10th [a source title]{: class=”” } - same IAL form with a multi-word phrase inside - [a source title]{: class="" }

11th an unknown notice block declaration - {: source } (hopefully invisible too)

Paired-marker notice blocks (multi-block form)

Verifies the _plugins/expand_notice_blocks.rb plugin: the paired {: .notice--TYPE-start} … {: .notice--TYPE-end} markers must wrap multiple Markdown blocks (paragraphs, ordered/unordered lists, fenced code, headings) inside a single notice container; tooltips, macros, and Liquid variables must still expand inside; the literal escaped form \{: .notice--TYPE-start\} must remain visible as plain text; markers inside fenced code blocks must be left untouched (documented verbatim); and the auto-blank-line convenience must keep list rendering correct even when a bullet/numbered list immediately follows the start marker with no manual blank line in between.

The CSS-injected icon and label render inline with the first line of the first inner block when that block is a paragraph or heading. When the first inner block is a list (<ol> or <ul>), the icon and label render on the wrapping container’s own line above the list — leading with a paragraph or heading is the way to keep the prefix inline with body text.

All five Minimal Mistakes notice types are exercised below (primary, info, warning, danger, success).

Primary — wraps a paragraph and an unordered list (no blank line before list)

Paired form ({: .notice--primary-start/-end}) wrapping mixed inline content.

The ${HOST} macro and the syslog-ng OSE Liquid variable must both expand here, and the link to Install Homebrew must still resolve.

first bullet — time-zone() should be tooltipped outside backticks: time-zone()
second bullet — a fully-qualified URL grpc keepalive must stay intact
third bullet — title autolink: Slack destination options

Info — wraps an ordered list (auto blank-line insertion test, list-first prefix placement)

Paired form ({: .notice--info-start/-end}) wrapping a numbered list with no manual blank line after the start marker. Because the first inner block is a list, the CSS-injected icon and INFO: label must render on the wrapper’s own line above the list — not inline with item 1..

first numbered item
second numbered item — uses the ${MESSAGE} macro
third numbered item — references syslog-ng Open Source Edition

Warning — wraps a fenced code block plus prose

Paired form ({: .notice--warning-start/-end}) wrapping a fenced code block between two paragraphs.

Leading paragraph that mentions log-msg-size() and ${PROGRAM} as plain text.

destination d_http {
    http(
        url("http://example.com/logs")
        batch-lines(100)
    );
};

Closing paragraph — content inside the fence above must NOT be tooltipped, and the fence must render as a code block (not as indented text).

Danger — wraps a heading, a paragraph, and a list

Paired form ({: .notice--danger-start/-end}) wrapping a nested heading, prose, and a bullet list.

Nested heading inside a notice

Some prose between the heading and the list.

bullet a
bullet b
bullet c

And a test link of a ${HOST}.

Success — single-paragraph paired form (functionally equivalent to single-block IAL)

Paired form ({: .notice--success-start/-end}) used for a one-paragraph notice — the single-block IAL would suffice.

A one-paragraph notice using the paired form also works, even though the legacy single-block {: .notice--success} IAL would suffice here. Test link of a ${HOST}.

Plain notice — no severity (single-block IAL only)

Generic gray callout for neutral asides. Only the single-block IAL form is supported — the paired-marker plugin accepts only the five typed variants.

NOTICE: A one-paragraph plain notice — inline tooltips like time-zone() and macros like ${HOST} still expand. Background mixes from $light-gray, so it stays a faint neutral gray, distinct from .notice--primary / .notice--info.

Paired markers nested inside an ordered list

The plugin emits the wrapping <div> at the marker’s indent so the notice stays inside its enclosing list item and the outer numbering is preserved (1, 2, 3 — not 1, 1, 1).

First step — plain item.
Second step — followed by a notice that must NOT break the numbering:
- inner bullet a
- inner bullet b
Third step — must still be numbered 3., not restart at 1..

Literal markers must remain visible

The escaped form \{: .notice--info-start\} and \{: .notice--info-end\} must render as plain text and MUST NOT be processed by the plugin.

Markers inside a fenced code block must be inert

The plugin’s SKIP_PATTERN excludes fenced code; the marker syntax is documented verbatim:

{: .notice--warning-start}

This is documentation showing the marker syntax — it must NOT expand
into a real notice, and the surrounding fenced block must render as a
code block. The CSS-injected icon and `WARNING:` label must not appear
either, because the markers are inert inside the fence.

{: .notice--warning-end}

Plain-text title matching and macros

Free-form prose that contains known link titles (Soft macros, hard macros, SDATA, ${HOST}) — verifies title-text matching across line breaks, longest-title-first sort, and that backticks make SDATA an inline-code unit (still matched if the title is SDATA).

Soft macros (sometimes also called name-value pairs) are either built-in macros automatically generated from the log message (for example, ${HOST}), or custom user-created macros generated by using the syslog-ng OSE pattern database or a CSV-parser. The SDATA fields of RFC-5424 formatted log messages become soft macros as well. In contrast with hard macros, soft macros are writable and can be modified within syslog-ng OSE, for example, using rewrite rules.

{: .notice–warning} Test
for the list of hard and soft macros, see Hard versus soft macros.

{: .notice–danger} Test
at the location it reaches the log-msg-size() value, and discards the rest of the message.

Fenced code blocks (must be fully inert)

Nothing inside a fenced block — option names, macros, titles, HTML comments — must be tooltipped or otherwise altered.

Code block example:

options {
    stats(
        freq(1)
        level(1)
        lifetime(1000)
        max-dynamics(10000)
        syslog-stats(yes)
        stats()
    );
};

log block example — replacement for the legacy > log line blockquote style. Renders as a soft, very light gray box with a left accent bar, italic, non-monospace text, and preserves leading whitespace. Tooltips/macros inside must NOT expand (same inertness contract as any other fenced block):

Follow-mode file source not found, deferring open; filename='/no_such_file_or.dir'
Reliable disk-buffer state saved; filename='/tmp/qdisk/syslog-ng-00000.rqf', qdisk_length='0'
No server license found, running in client mode;
syslog-ng starting up; version='7.0.20', cfg-fingerprint='eaa03b9efb88b87d7c1b0ce7efd042ed8ac0c013', >cfg-nonce-ndx='0', cfg-signature='c0327a7f7e6418ce0399a75089377dfb662bb072' FIPS information; FIPS-mode='disabled'
Syslog connection established; fd='7', server='AF_INET(10.21.10.20:514)', local='AF_INET(0.0.0.0:0)'
  at org.apache.catalina.connector.Connector.start(Connector.java:1138)
  at org.apache.catalina.core.StandardService.start(StandardService.java:531)
${HOST} and syslog-ng OSE appear here as literal text, NOT as expanded tokens.

XML block example with HTML comments:

<patterndb version='4' pub_date='2015-04-13'>
    <ruleset name='sshd' id='12345678'>
        <pattern>sshd</pattern>
            <rules>
                <!-- The pattern database rule for the first log message -->
                <rule provider='me' id='12347598' class='system'
                    context-id="ssh-login-logout" context-timeout="86400"
                    context-scope="process">
                <!-- Note the context-id that groups together the
                relevant messages, and the context-timeout value that
                determines how long a new message can be added to the
                context  -->
                    <patterns>
                        <pattern>Accepted @ESTRING:SSH.AUTH_METHOD: @for @ESTRING:SSH_USERNAME: @from @ESTRING:SSH_CLIENT_ADDRESS: @port @ESTRING:: @@ANYSTRING:SSH_SERVICE@</pattern>
                        <!-- This is the actual pattern used to identify
                        the log message. The segments between the @
                        characters are parsers that recognize the variable
                        parts of the message - they can also be used as
                        macros.  -->
                    </patterns>
                </rule>
            </rules>
    </ruleset>
</patterndb>

Tests of custom markdown in header link -> source and link -> with id

Introduction to syslog-ng OSE is a test for pages without description/subtitle, but text part between the title and the first heading which can have tooltips too this way.

Developer guide is a double (page title amd section heading) example with a description/subtitle.

Installing syslog-ng is a forced, (also a doubled) page link title example with a description/subtitle.

This one is a Self page link test with ID, this one with the title only - This’s a self made tools testing page of syslog-ng documentation, and a last one with direkt liquid usage - This’s a self made tools testing page of syslog-ng documentation.

Test of forced link with anchored ID part Install Homebrew.

Same test like above in an enumeration Install Homebrew.

TIP: Same again in a notice block Install Homebrew. If you have syslog-ng OSE installed via brew, as a reference, you can check the dependencies of the brew built version using brew deps syslog-ng

External links, long and short matching, search and tokens at backtick boundaries

Fully-qualified URLs in [text](https://...) must not collide with internal title matching; longer matches must have preference over shorter tokens; the search index must accept identical tokens twice on one line; tokens like time-zone() switch behavior in/out of backticks.

Embedded markdown style link test from a different domain

Search test for RFC-3526 and RFC-3526. (you need to turn ‘search: true’ on temporally in the liquid header of this test page)

The severity of the message. time-zone() teszt

parser: Parse and segment structured messages

parser: Parse and segment structured messages

discord Sending alerts and notifications to Discord

discord Sending alerts and notifications to Discord

Timezones and daylight saving

Timezones and daylight saving

Slack destination options - destination is a known title, but the whole phrase as well, so the whole thing should be linked, not just the word destination

Slack destination options

Slack destination options

Slack :destination options

Slack ‘destination’ options

All variants of the [[...]] and [[title|id]] custom markdown — including the literal-bracket-and-pipe escapes (|, \|), nested [[[[...]]]] form, malformed cases (empty id [[t|]], double pipe [[t||]]), and single-bracket non-matches.

destination - destination known title without autolink

destination - [[destination]] forced autolink form

[[destination]] - [[[[destination]]]] double nested form

destination id=bom - [[destination id=bom|adm-about-glossary#bom]] different title, id=bom

destination - [[destination|adm-about-glossary#bom]] id=bom

[[destination|bom_id]] - [[\[\[destination|bom_id\]\]|adm-about-glossary#bom]] exact example different title, id=bom

[[destination|]] - [[destination|]] malformed, empty id

[[destination||]] - [[destination||]] malformed, double pipe

[destination ] - [destination|] single [, empty id; | is not escaped therefore will be genereated as a table cell separator

destination - destination| - | is not escaped therefore will be genereated as a table cell separator

[destination] - [destination]

Tokens around backticks, pre-rendered HTML, and Liquid includes

A token immediately wrapped in backticks must stay an inline-code unit and not be re-tooltipped; a pre-rendered <a class="...content-tooltip"> must not be re-wrapped recursively; the markdown_link Liquid include must work with all quoting variants of id / title / withTooltip.

Options of the mqtt() destination

[parser bar]

Alma parser korte

This is a direct, html link destination - <a href="/admin-guide/200_About/002_Glossary#destination" class="nav-link content-tooltip">destination</a>

another destination - [[another destination|adm-about-glossary#destination]]

markdown_link test destination apostroph

markdown_link test destination quote

markdown_link test withTooltip=”yes”

markdown_link test withTooltip=yes

markdown_link test withTooltip=”true”

markdown_link test withTooltip=true

Excluded words and overrides

option / Option / Options are listed in _data/excluded_titles.yml so plain prose mentions must NOT be linked. The [[Option|id]] form must override the exclusion.

option

Options is an excluded word.

[[Option]] is excluded

option is excluded, but overidden

Apostrophes adjacent to titles

Trailing ’s or 's after a title, curly Unicode apostrophe (’) inside a title must not break boundary detection.

’ outside of a title Options of the kafka() destination’s C implementation or Options of the kafka() destination’s C implementation.

' outside of a title Options of the kafka() destination’s C implementation or Options of the kafka() destination’s C implementation.

Title with ’ This’s a self made tools testing page of syslog-ng documentation or This’s a self made tools testing page of syslog-ng documentation.

Liquid raw tag and escaping

A {% raw %} block must preserve its contents through Jekyll’s Liquid pass; using % HTML entities is one workaround when the raw block alone is not enough; the render_with_liquid: false frontmatter switch is another. Both are exercised here.

Here comes a liquid {% include doc/admin-guide/manpages-footnote.md %} and a {{ site.product.name }} variable raw inclusion test

One more without any escaping using the render_with_liquid: false frontmatter option {% include doc/admin-guide/manpages-footnote.md %} and a {{ site.product.name }} variable raw inclusion test

Showing literal Liquid tags on a page is tricky because two Liquid passes touch the source:

Our generate_tooltips.rb plugin runs its own Liquid parse/render on the raw markdown — it does not honor the render_with_liquid: false frontmatter switch.
Jekyll’s final Liquid pass is skipped by render_with_liquid: false, but only that one.

Practical rules:

In body text, wrap every literal {% ... %} and {{ ... }} in {% raw %}…{% endraw %}; backticks alone do not shield Liquid from step (1). The kramdown-level \{ escape also does not help — Liquid sees the raw \{% and still tries to tokenize it.
In headings, do not use literal {% or {{ at all — generate_links.rb runs Liquid::Template.parse on every heading’s text via Nokogiri, which strips backtick <code> wrappers, so even backticked literals will break Build 1. Rephrase the heading instead (e.g. “Liquid raw tag” rather than {% raw %}).
The render_with_liquid: false frontmatter is still useful: it suppresses the final Jekyll Liquid pass that would otherwise re-evaluate our plugin output, and is required on pages that show raw Liquid examples.

Further liquid site variable tests.
When encoding is set in a source (using the encoding() option) and the message is longer (in bytes) than log-msg-size() in UTF-8 representation, syslog-ng OSE splits the message at an undefined location (because the conversion between different encodings is not trivial).

The following is a simple configuration file for syslog-ng Open Source Edition that collects incoming log messages and stores them in a text file. syslog-ng Open Source Edition.

Title aliases and case-sensitivity

${LEVEL} and ${PRIORITY} are aliases of ${PRIORITY}/SDATA (see _data/link_aliases.yml); the Fully Qualified Domain Name series tests that title matching is case-sensitive at the per-letter level (only the canonical capitalization resolves).

Alias testing e.g ${LEVEL} or ${PRIORITY} should work like ${SDATA}

Fully Qualified Domain Name

fully qualified domain name

Fully qualified domain Name

fully Qualified domain Name

Fully qualified domain name

FQDN

F.Q.D.N.

Render-pipeline edge cases

Cases that exercise the boundary between Liquid, kramdown and the custom tooltip injector. These are added on top of the cases above to cover scenarios that did not have a dedicated row before.

HTML comment in body containing markdown-like content

The whole comment must stay inert — no inline-code, no autolink, no fence detection inside. Verifies that the comment alternation in markdown_blocks_pattern consumes its content as a single unit.

Code fence whose content contains an HTML comment

This is the patterndb-style case: an xml fence contains real  markup. Macros inside the fence (${DATE}, ${PID}) must NOT be linked. Verifies that the fence wins over the inner comment because it opens first in the source.

<patterndb>
  <!-- ${DATE} and ${PID} must remain plain text inside this fence -->
  <value name="MESSAGE">${HOST} ${PROGRAM}</value>
</patterndb>

HTML comment containing a fence opener but no closer

The comment must consume the dangling triple-backtick fragment as inert text and must not leave an unpaired fence behind.

Text after the comment must render normally, with time-zone() still inline-code and ${HOST} still linked.

Adjacent macros without separators

Chained macro tokens with no whitespace between them — both must be linked, the closing } of the first must be accepted as a left boundary for the next.

${HOST}${PROGRAM} ${HOST}.${PROGRAM} ${HOST},${PROGRAM}

Title at start-of-line and at end-of-paragraph

A known title (Soft macros) appearing as the very first token of a line and as the last token before a blank line — boundary detection must use ^ / \z correctly.

Soft macros at the very start of this line.

This paragraph ends with the title Soft macros

Title inside a list item and a table cell

List items and tables put titles in slightly unusual surroundings; both must still be linked and the table column alignment must remain intact.

list item containing the title Soft macros mid-sentence
another item with time-zone() as inline code

Concept	Example
Soft macro	${HOST}
Hard macro	${MESSAGE}

Four-backtick fence

The markdown_blocks_pattern supports up to four backticks to allow embedding a triple-backtick example inside an example. The whole outer fence must stay inert.

```config
destination d_demo { http(url("http://x/${HOST}") batch-lines(100)); };
```

Comment immediately followed by a fence on the next line

No blank line between them — the comment must close cleanly on its own --> and the fence must open fresh on the next line, both staying independently inert.

destination d_demo { http(url("http://x") batch-lines(100)); };

Liquid comment tag block

A {% comment %} block is stripped by Liquid before our plugin sees the content. Nothing inside is rendered, so even tokens that look like titles or macros must be invisible in the output.

(End of Render-pipeline edge cases.)

—- Footer test —-

If you experience any problems or need help with syslog-ng OSE, see the syslog-ng OSE Administration Guide[1], or visit the syslog-ng OSE mailing list[2]. For news and notifications about syslog-ng OSE, visit the syslog-ng OSE blogs[3].

AUTHOR

This manual page was generated from the syslog-ng OSE Administration Guide[1], which was written by several contributors to whom we’d like to extend our sincere thanks. All contributions are accepted under the syslog-ng Open Source Edition Contributor License Agreement[5].

COPYRIGHT

This manual page is part of the syslog-ng Open Source Edition documentation and is distributed under the terms of the syslog-ng Open Source Edition Documentation License[4], which grants free use subject to attribution, modification-notice, trademark, and US export-control conditions. The documentation is provided “AS IS”, without warranty of any kind. See the full license text for the complete terms.

NOTES

[1] syslog-ng OSE Administration Guide https://syslog-ng.github.io/admin-guide/README

[2] syslog-ng OSE mailing list https://lists.balabit.hu/mailman/listinfo/syslog-ng

[3] syslog-ng OSE blogs https://syslog-ng.com/blog/

[4] syslog-ng Open Source Edition Documentation License https://syslog-ng.github.io/admin-guide/200_About/001_Documentation_license

[5] syslog-ng Open Source Edition Contributor License Agreement https://syslog-ng.github.io/admin-guide/200_About/003_CLA